Privacy policy

1. Controller

Universe Profile AS (org. no. 929 413 318), with registered address Ustadhagan 4, 3490 Klokkarstua, Asker, Norway, is the controller of personal data processed through this website and in connection with our services.

Privacy contact: info@universeprofile.no

2. Data we collect

We process the following categories of personal data:

• Contact details: name, email address, phone number
• Company information: company name, organisation number, invoice address
• Order data: order history, product choices, delivery address
• Files you send us: logos, print files and designs from the studio
• Names and sizes of employees or team members, when the company or team enters them to order clothing
• Technical data: IP address and browser, used to stop misuse of the forms and the login. When you open a quote from us, we record the time, IP address and browser.

If you pay by card, you enter the card details directly with Stripe. We never see the card number.

3. Purposes

Personal data is used for the following purposes:

• Order processing and delivery of products
• Customer service and communication about orders
• Invoicing and accounting
• Improving the website and services
• Reminders about reordering to customers who have bought before. Tell us to stop.
• Visitor statistics, only if you have said yes
• Compliance with legal requirements

4. Legal basis

Processing takes place on the following legal bases under the GDPR:

• Art. 6(1)(a) (Consent): Visitor statistics.
• Art. 6(1)(b) (Contract): Processing necessary to perform a contract with you, including order processing and delivery.
• Art. 6(1)(c) (Legal obligation): Retention of order and invoice records under the Norwegian Bookkeeping Act.
• Art. 6(1)(f) (Legitimate interest): Following up enquiries, improving our services and protecting against misuse and fraud.

5. Sharing with third parties

We use these vendors to process data on our behalf. They receive only what they need for their task:

• Vercel: Hosting of the website and portal from servers in Frankfurt, and storage of files you upload
• Neon: The database. The servers are in Frankfurt.
• Microsoft 365: Our email. What you write to us and what we reply is kept in our email accounts there. Login for admins and customers who use Microsoft 365 also goes through Microsoft (Entra ID).
• Stripe: Card payment. When a card payment goes through Northflow Payments, Universe Profile AS is still the seller, and the money goes to our account.
• Tripletex: Invoicing and accounting
• monday.com: Customer follow-up (CRM), receives enquiries with name, email, phone and the message
• Resend: Sends email from the website and portal, such as the receipt when you have contacted us and the order confirmation when you have ordered
• Cloudinary: Image storage and optimisation
• Upstash: Abuse protection (limits the number of requests per IP address)
• Umami: Visitor statistics, only if you have said yes, see below. Northflow runs the statistics for us at analytics.northflow.no and is the processor for it.

When you order, the production partners who print and embroider the goods, and the carrier who delivers them, receive the delivery address and the order lines. They use them only to make and deliver your order.

Vercel, Neon, Microsoft, Stripe, Resend, Cloudinary and Upstash have American owners, and some of them may process data in the USA. Such transfers take place on the basis of the EU standard contractual clauses (SCC) or an equivalent valid transfer mechanism. We never sell personal data to third parties.

6. Storage and retention

We keep orders, quotes and invoice records for as long as the customer relationship lasts, and at least as long as the Norwegian Bookkeeping Act requires (five years for sales documents).

Some data is deleted automatically every week:

• Enquiries from the studio that did not lead to a customer relationship or a quote are deleted from the website after 24 months. Copies in email and in monday.com are not deleted automatically. Tell us, and we will delete them.
• Invitations to state a clothing size that were never answered: after 24 months.
• IP address and browser from views of quotes: after 14 months.
• Logins and links to confirm an email address: when they have expired.

Cookies are deleted when the time stated on the cookies page has passed.

7. Your rights

You have the following rights under the GDPR:

• Access: You can ask for a copy of the data we hold about you.
• Rectification: You can ask us to correct inaccurate data.
• Erasure: You can ask us to delete data when there is no longer a basis for processing it.
• Restriction: You can ask us to restrict processing while something is being clarified.
• Objection: You can object to processing based on legitimate interest.
• Withdrawing consent: You can change your answer about visitor statistics at any time, at the bottom of every page.
• Data portability: You can ask to receive your data in a machine-readable format.
• Complaint: You have the right to complain to the Norwegian Data Protection Authority (Datatilsynet) if you believe the processing breaches data protection law.

Datatilsynet: www.datatilsynet.no

8. Cookies

The website uses cookies that are necessary for it to work, for example to keep you logged in to the customer portal. We use visitor statistics only if you have said yes. The full list is on the cookies page.

9. Contact us

If you have questions about how we process personal data, contact us:

Universe Profile AS
Ustadhagan 4, 3490 Klokkarstua, Asker, Norway
Phone: +47 416 17 416
Email: info@universeprofile.no